Security of controlled manufacturing systems in the connected factory: the case of industrial robots

Abstract

In modern factories, "controlled" manufacturing systems, such as industrial robots, CNC machines, or 3D printers, are often connected in a control network, together with a plethora of heterogeneous control devices. Despite the obvious advantages in terms of production and ease of maintenance, this trend raises non-trivial cybersecurity concerns. Often, the devices employed are not designed for an interconnected world, but cannot be promptly replaced: In fact, they have essentially become legacy systems, embodying design patterns where components and networks are accounted as trusted elements. In this paper, we take a holistic view of the security issues (and challenges) that arise in designing and securely deploying controlled manufacturing systems, using industrial robots as a case study-indeed, robots are the most representative instance of a complex automatically controlled industrial device. Following up to our previous experimental analysis, we take a broad look at the deployment of industrial robots in a typical factory network

Detecting Insecure Code Patterns in Industrial Robot Programs

“…Our analysis tool can detect both security-sensitive code patterns that could lead to vulnerabilities in task programs as well as malicious patterns that could lead to malware. First, using our tool we were able to confirm the path-traversal vulnerability that the authors of [18] found manually. Such vulnerability resulted in ABB removing the vulnerable application from the online repository.…”

“…However, the security impact of these primitives has not been studied yet. Our previous research [18] found a path traversal vulnerability in a real-world program: A web server written in ABB's RAPID. This vulnerability allows attackers to access (sensitive) files outside of the root directory served by the application.…”

“…Example. In previous research [18], we found a real case of vulnerable application for industrial robots, which was made available through ABB's RobotApps platform 7 . The application runs as a web server providing static and dynamic pages.…”

“…Recent research looked into the security of industrial machinery, such as robots. In our previous research [19], we focused on the security properties of industrial robots, and in a follow-up paper [18], we mentioned how task programs are part of the attack surface, showing an example of an application written in a IRPL and vulnerable to a "path traversal" issue. Despite this, currently, there are neither security analysis tools for programs written in IRPLs, nor security mechanisms to implement resource isolation in common robotic operating systems (e.g., privilege separation).…”

End Position Detection of Industrial Robots Based on Laser Tracker

“…Industrial robot is a highly integrated product of mechatronics. This a high value-added technical product enjoys a wide scope of application, setting a benchmark for industrial automation and Industry 4.0 [1]. In recent years, domestic industrial robots have been applied in more and more scenarios.…”